Index: head/www/waterfox/files/patch-bug1388020 =================================================================== --- head/www/waterfox/files/patch-bug1388020 (revision 462557) +++ head/www/waterfox/files/patch-bug1388020 (revision 462558) @@ -1,439 +1,439 @@ commit 56cb3a82e6f1 Author: Andrew Osmond Date: Wed Feb 7 09:33:12 2018 -0500 Bug 1388020. r=nical a=RyanVM --HG-- extra : source : fd15c14e5efb1874591f4e113c1ae1c49154804f --- gfx/layers/client/TextureClient.h | 2 +- gfx/layers/composite/TextureHost.cpp | 65 +++++++++++++++++++----- gfx/layers/composite/X11TextureHost.cpp | 13 +++-- gfx/layers/d3d11/TextureD3D11.cpp | 6 +-- gfx/layers/opengl/MacIOSurfaceTextureHostOGL.cpp | 8 +++ gfx/layers/opengl/TextureHostOGL.cpp | 25 ++------- gfx/tests/gtest/TestLayers.h | 16 ++++++ gfx/tests/gtest/TestTextureCompatibility.cpp | 12 +++-- gfx/tests/gtest/TestTextures.cpp | 7 ++- gfx/tests/gtest/TextureHelper.h | 3 +- 10 files changed, 108 insertions(+), 49 deletions(-) diff --git gfx/layers/client/TextureClient.h gfx/layers/client/TextureClient.h index e56ea21841ad..81be2867ca7a 100644 --- gfx/layers/client/TextureClient.h +++ gfx/layers/client/TextureClient.h @@ -761,7 +761,7 @@ protected: friend void TestTextureClientSurface(TextureClient*, gfxImageSurface*); friend void TestTextureClientYCbCr(TextureClient*, PlanarYCbCrData&); friend already_AddRefed CreateTextureHostWithBackend( - TextureClient*, LayersBackend&); + TextureClient*, ISurfaceAllocator*, LayersBackend&); #ifdef GFX_DEBUG_TRACK_CLIENTS_IN_POOL public: diff --git gfx/layers/composite/TextureHost.cpp gfx/layers/composite/TextureHost.cpp index a48a9081e155..e0a74920fbe5 100644 --- gfx/layers/composite/TextureHost.cpp +++ gfx/layers/composite/TextureHost.cpp @@ -116,15 +116,9 @@ TextureHost::CreateIPDLActor(HostIPCAllocator* aAllocator, uint64_t aSerial, const wr::MaybeExternalImageId& aExternalImageId) { - if (aSharedData.type() == SurfaceDescriptor::TSurfaceDescriptorBuffer && - aSharedData.get_SurfaceDescriptorBuffer().data().type() == MemoryOrShmem::Tuintptr_t && - !aAllocator->IsSameProcess()) - { - NS_ERROR("A client process is trying to peek at our address space using a MemoryTexture!"); - return nullptr; - } TextureParent* actor = new TextureParent(aAllocator, aSerial, aExternalImageId); if (!actor->Init(aSharedData, aLayersBackend, aFlags)) { + actor->ActorDestroy(ipc::IProtocol::ActorDestroyReason::FailedConstructor); delete actor; return nullptr; } @@ -232,6 +226,11 @@ TextureHost::Create(const SurfaceDescriptor& aDesc, #ifdef MOZ_X11 case SurfaceDescriptor::TSurfaceDescriptorX11: { + if (!aDeallocator->IsSameProcess()) { + NS_ERROR("A client process is trying to peek at our address space using a X11Texture!"); + return nullptr; + } + const SurfaceDescriptorX11& desc = aDesc.get_SurfaceDescriptorX11(); result = MakeAndAddRef(aFlags, desc); break; @@ -248,7 +247,7 @@ TextureHost::Create(const SurfaceDescriptor& aDesc, MOZ_CRASH("GFX: Unsupported Surface type host"); } - if (WrapWithWebRenderTextureHost(aDeallocator, aBackend, aFlags)) { + if (result && WrapWithWebRenderTextureHost(aDeallocator, aBackend, aFlags)) { MOZ_ASSERT(aExternalImageId.isSome()); result = new WebRenderTextureHost(aDesc, aFlags, result, aExternalImageId.ref()); } @@ -269,13 +268,50 @@ CreateBackendIndependentTextureHost(const SurfaceDescriptor& aDesc, const MemoryOrShmem& data = bufferDesc.data(); switch (data.type()) { case MemoryOrShmem::TShmem: { - result = new ShmemTextureHost(data.get_Shmem(), - bufferDesc.desc(), - aDeallocator, - aFlags); + const ipc::Shmem& shmem = data.get_Shmem(); + const BufferDescriptor& desc = bufferDesc.desc(); + if (!shmem.IsReadable()) { + // We failed to map the shmem so we can't verify its size. This + // should not be a fatal error, so just create the texture with + // nothing backing it. + result = new ShmemTextureHost(shmem, desc, aDeallocator, aFlags); + break; + } + + size_t bufSize = shmem.Size(); + size_t reqSize = SIZE_MAX; + switch (desc.type()) { + case BufferDescriptor::TYCbCrDescriptor: { + const YCbCrDescriptor& ycbcr = desc.get_YCbCrDescriptor(); + reqSize = -+ ImageDataSerializer::ComputeYCbCrBufferSize(ycbcr.ySize(), ycbcr.yStride(), -+ ycbcr.cbCrSize(), ycbcr.cbCrStride()); ++ ImageDataSerializer::ComputeYCbCrBufferSize(ycbcr.ySize(), ycbcr.ySize().width, ++ ycbcr.cbCrSize(), ycbcr.cbCrSize().width); + break; + } + case BufferDescriptor::TRGBDescriptor: { + const RGBDescriptor& rgb = desc.get_RGBDescriptor(); + reqSize = ImageDataSerializer::ComputeRGBBufferSize(rgb.size(), rgb.format()); + break; + } + default: + gfxCriticalError() << "Bad buffer host descriptor " << (int)desc.type(); + MOZ_CRASH("GFX: Bad descriptor"); + } + + if (bufSize < reqSize) { + NS_ERROR("A client process gave a shmem too small to fit for its descriptor!"); + return nullptr; + } + + result = new ShmemTextureHost(shmem, desc, aDeallocator, aFlags); break; } case MemoryOrShmem::Tuintptr_t: { + if (!aDeallocator->IsSameProcess()) { + NS_ERROR("A client process is trying to peek at our address space using a MemoryTexture!"); + return nullptr; + } + result = new MemoryTextureHost(reinterpret_cast(data.get_uintptr_t()), bufferDesc.desc(), aFlags); @@ -293,6 +329,11 @@ CreateBackendIndependentTextureHost(const SurfaceDescriptor& aDesc, } #ifdef XP_WIN case SurfaceDescriptor::TSurfaceDescriptorDIB: { + if (!aDeallocator->IsSameProcess()) { + NS_ERROR("A client process is trying to peek at our address space using a DIBTexture!"); + return nullptr; + } + result = new DIBTextureHost(aFlags, aDesc); break; } diff --git gfx/layers/composite/X11TextureHost.cpp gfx/layers/composite/X11TextureHost.cpp index e2251f0c531a..94cb3f2f9594 100644 --- gfx/layers/composite/X11TextureHost.cpp +++ gfx/layers/composite/X11TextureHost.cpp @@ -23,10 +23,9 @@ X11TextureHost::X11TextureHost(TextureFlags aFlags, const SurfaceDescriptorX11& aDescriptor) : TextureHost(aFlags) { - RefPtr surface = aDescriptor.OpenForeign(); - mSurface = surface.get(); + mSurface = aDescriptor.OpenForeign(); - if (!(aFlags & TextureFlags::DEALLOCATE_CLIENT)) { + if (mSurface && !(aFlags & TextureFlags::DEALLOCATE_CLIENT)) { mSurface->TakePixmap(); } } @@ -34,7 +33,7 @@ X11TextureHost::X11TextureHost(TextureFlags aFlags, bool X11TextureHost::Lock() { - if (!mCompositor) { + if (!mCompositor || !mSurface) { return false; } @@ -75,6 +74,9 @@ X11TextureHost::SetTextureSourceProvider(TextureSourceProvider* aProvider) SurfaceFormat X11TextureHost::GetFormat() const { + if (!mSurface) { + return SurfaceFormat::UNKNOWN; + } gfxContentType type = mSurface->GetContentType(); #ifdef GL_PROVIDER_GLX if (mCompositor->GetBackendType() == LayersBackend::LAYERS_OPENGL) { @@ -87,6 +89,9 @@ X11TextureHost::GetFormat() const IntSize X11TextureHost::GetSize() const { + if (!mSurface) { + return IntSize(); + } return mSurface->GetSize(); } diff --git gfx/layers/d3d11/TextureD3D11.cpp gfx/layers/d3d11/TextureD3D11.cpp index 379686418ef0..4ad758849b93 100644 --- gfx/layers/d3d11/TextureD3D11.cpp +++ gfx/layers/d3d11/TextureD3D11.cpp @@ -763,10 +763,6 @@ CreateTextureHostD3D11(const SurfaceDescriptor& aDesc, { RefPtr result; switch (aDesc.type()) { - case SurfaceDescriptor::TSurfaceDescriptorBuffer: { - result = CreateBackendIndependentTextureHost(aDesc, aDeallocator, aBackend, aFlags); - break; - } case SurfaceDescriptor::TSurfaceDescriptorD3D10: { result = new DXGITextureHostD3D11(aFlags, aDesc.get_SurfaceDescriptorD3D10()); @@ -778,7 +774,7 @@ CreateTextureHostD3D11(const SurfaceDescriptor& aDesc, break; } default: { - NS_WARNING("Unsupported SurfaceDescriptor type"); + MOZ_ASSERT_UNREACHABLE("Unsupported SurfaceDescriptor type"); } } return result.forget(); diff --git gfx/layers/opengl/MacIOSurfaceTextureHostOGL.cpp gfx/layers/opengl/MacIOSurfaceTextureHostOGL.cpp index 291b0eb3d0dc..f363bb5a7cf7 100644 --- gfx/layers/opengl/MacIOSurfaceTextureHostOGL.cpp +++ gfx/layers/opengl/MacIOSurfaceTextureHostOGL.cpp @@ -32,6 +32,8 @@ MacIOSurfaceTextureHostOGL::~MacIOSurfaceTextureHostOGL() GLTextureSource* MacIOSurfaceTextureHostOGL::CreateTextureSourceForPlane(size_t aPlane) { + MOZ_ASSERT(mSurface); + GLuint textureHandle; gl::GLContext* gl = mProvider->GetGLContext(); gl->fGenTextures(1, &textureHandle); @@ -94,11 +96,17 @@ MacIOSurfaceTextureHostOGL::SetTextureSourceProvider(TextureSourceProvider* aPro gfx::SurfaceFormat MacIOSurfaceTextureHostOGL::GetFormat() const { + if (!mSurface) { + return gfx::SurfaceFormat::UNKNOWN; + } return mSurface->GetFormat(); } gfx::SurfaceFormat MacIOSurfaceTextureHostOGL::GetReadFormat() const { + if (!mSurface) { + return gfx::SurfaceFormat::UNKNOWN; + } return mSurface->GetReadFormat(); } diff --git gfx/layers/opengl/TextureHostOGL.cpp gfx/layers/opengl/TextureHostOGL.cpp index bdcd8778c10d..2b28c19a126d 100644 --- gfx/layers/opengl/TextureHostOGL.cpp +++ gfx/layers/opengl/TextureHostOGL.cpp @@ -26,10 +26,6 @@ #include "mozilla/layers/MacIOSurfaceTextureHostOGL.h" #endif -#ifdef GL_PROVIDER_GLX -#include "mozilla/layers/X11TextureHost.h" -#endif - using namespace mozilla::gl; using namespace mozilla::gfx; @@ -46,14 +42,6 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc, { RefPtr result; switch (aDesc.type()) { - case SurfaceDescriptor::TSurfaceDescriptorBuffer: { - result = CreateBackendIndependentTextureHost(aDesc, - aDeallocator, - aBackend, - aFlags); - break; - } - #ifdef MOZ_WIDGET_ANDROID case SurfaceDescriptor::TSurfaceTextureDescriptor: { const SurfaceTextureDescriptor& desc = aDesc.get_SurfaceTextureDescriptor(); @@ -88,14 +76,6 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc, } #endif -#ifdef GL_PROVIDER_GLX - case SurfaceDescriptor::TSurfaceDescriptorX11: { - const auto& desc = aDesc.get_SurfaceDescriptorX11(); - result = new X11TextureHost(aFlags, desc); - break; - } -#endif - case SurfaceDescriptor::TSurfaceDescriptorSharedGLTexture: { const auto& desc = aDesc.get_SurfaceDescriptorSharedGLTexture(); result = new GLTextureHost(aFlags, desc.texture(), @@ -105,7 +85,10 @@ CreateTextureHostOGL(const SurfaceDescriptor& aDesc, desc.hasAlpha()); break; } - default: return nullptr; + default: { + MOZ_ASSERT_UNREACHABLE("Unsupported SurfaceDescriptor type"); + break; + } } return result.forget(); } diff --git gfx/tests/gtest/TestLayers.h gfx/tests/gtest/TestLayers.h index 18e351f7718c..fc6b750f1c62 100644 --- gfx/tests/gtest/TestLayers.h +++ gfx/tests/gtest/TestLayers.h @@ -8,6 +8,22 @@ #include "Layers.h" #include "nsTArray.h" +#include "mozilla/layers/ISurfaceAllocator.h" + +namespace mozilla { +namespace layers { + +class TestSurfaceAllocator final : public ISurfaceAllocator +{ +public: + TestSurfaceAllocator() {} + ~TestSurfaceAllocator() override {} + + bool IsSameProcess() const override { return true; } +}; + +} // layers +} // mozilla /* Create layer tree from a simple layer tree description syntax. * Each index is either the first letter of the layer type or diff --git gfx/tests/gtest/TestTextureCompatibility.cpp gfx/tests/gtest/TestTextureCompatibility.cpp index 45db4943ed1c..0815823b81ce 100644 --- gfx/tests/gtest/TestTextureCompatibility.cpp +++ gfx/tests/gtest/TestTextureCompatibility.cpp @@ -14,6 +14,7 @@ #include "mozilla/layers/TextureClient.h" #include "mozilla/layers/TextureHost.h" #include "mozilla/RefPtr.h" +#include "TestLayers.h" #include "TextureHelper.h" using mozilla::gfx::Feature; @@ -22,6 +23,7 @@ using mozilla::layers::BasicCompositor; using mozilla::layers::Compositor; using mozilla::layers::CompositorOptions; using mozilla::layers::LayersBackend; +using mozilla::layers::TestSurfaceAllocator; using mozilla::layers::TextureClient; using mozilla::layers::TextureHost; using mozilla::widget::CompositorWidget; @@ -31,8 +33,9 @@ using mozilla::widget::InProcessCompositorWidget; * This function will create the possible TextureClient and TextureHost pairs * according to the given backend. */ -void +static void CreateTextureWithBackend(LayersBackend& aLayersBackend, + ISurfaceAllocator* aDeallocator, nsTArray>& aTextureClients, nsTArray>& aTextureHosts) { @@ -43,7 +46,8 @@ CreateTextureWithBackend(LayersBackend& aLayersBackend, for (uint32_t i = 0; i < aTextureClients.Length(); i++) { aTextureHosts.AppendElement( - CreateTextureHostWithBackend(aTextureClients[i], aLayersBackend)); + CreateTextureHostWithBackend(aTextureClients[i], aDeallocator, + aLayersBackend)); } } @@ -115,13 +119,15 @@ CheckCompatibilityWithBasicCompositor(LayersBackend aBackends, TEST(Gfx, TestTextureCompatibility) { nsTArray backendHints; + RefPtr deallocator = new TestSurfaceAllocator(); GetPlatformBackends(backendHints); for (uint32_t i = 0; i < backendHints.Length(); i++) { nsTArray> textureClients; nsTArray> textureHosts; - CreateTextureWithBackend(backendHints[i], textureClients, textureHosts); + CreateTextureWithBackend(backendHints[i], deallocator, + textureClients, textureHosts); CheckCompatibilityWithBasicCompositor(backendHints[i], textureHosts); } } diff --git gfx/tests/gtest/TestTextures.cpp gfx/tests/gtest/TestTextures.cpp index 19b94b867117..291eb55ca7e5 100644 --- gfx/tests/gtest/TestTextures.cpp +++ gfx/tests/gtest/TestTextures.cpp @@ -5,6 +5,7 @@ #include "gtest/gtest.h" #include "gmock/gmock.h" +#include "TestLayers.h" #include "mozilla/gfx/2D.h" #include "mozilla/gfx/Tools.h" @@ -147,7 +148,8 @@ void TestTextureClientSurface(TextureClient* texture, gfxImageSurface* surface) ASSERT_NE(descriptor.type(), SurfaceDescriptor::Tnull_t); // host deserialization - RefPtr host = CreateBackendIndependentTextureHost(descriptor, nullptr, + RefPtr deallocator = new TestSurfaceAllocator(); + RefPtr host = CreateBackendIndependentTextureHost(descriptor, deallocator, LayersBackend::LAYERS_NONE, texture->GetFlags()); @@ -193,7 +195,8 @@ void TestTextureClientYCbCr(TextureClient* client, PlanarYCbCrData& ycbcrData) { ASSERT_EQ(ycbcrDesc.stereoMode(), ycbcrData.mStereoMode); // host deserialization - RefPtr textureHost = CreateBackendIndependentTextureHost(descriptor, nullptr, + RefPtr deallocator = new TestSurfaceAllocator(); + RefPtr textureHost = CreateBackendIndependentTextureHost(descriptor, deallocator, LayersBackend::LAYERS_NONE, client->GetFlags()); diff --git gfx/tests/gtest/TextureHelper.h gfx/tests/gtest/TextureHelper.h index 144a237b17d4..770f7464f829 100644 --- gfx/tests/gtest/TextureHelper.h +++ gfx/tests/gtest/TextureHelper.h @@ -140,6 +140,7 @@ CreateTextureClientWithBackend(LayersBackend aLayersBackend) */ already_AddRefed CreateTextureHostWithBackend(TextureClient* aClient, + ISurfaceAllocator* aDeallocator, LayersBackend& aLayersBackend) { if (!aClient) { @@ -153,7 +154,7 @@ CreateTextureHostWithBackend(TextureClient* aClient, aClient->ToSurfaceDescriptor(descriptor); wr::MaybeExternalImageId id = Nothing(); - return TextureHost::Create(descriptor, nullptr, aLayersBackend, + return TextureHost::Create(descriptor, aDeallocator, aLayersBackend, aClient->GetFlags(), id); }